Catch Chrome extension packaging mistakes before you upload (free, local tool)

Every extension developer has experienced the frustration of accidentally uploading an incorrect file to their Chrome extension. A missing file pointed to in the manifest, a missing default locale message, or an icon that isn't actually a PNG can all cause issues. To catch these mistakes before uploading, developer <name> created ExtensionRelease Guard, a free local tool that inspects the ZIP file of an extension.

ExtensionRelease Guard examines several aspects of the extension. It checks the ZIP itself, looking for path-traversal names, duplicate or case-colliding names, encrypted entries, symlinks, and unusually high compression ratios. It then inspects the manifest.json file for required fields and basic structure. Next, it checks for references in the manifest to files that don't exist in the archive.

The tool also checks the default locale and its messages, as well as the icon files to ensure they match the type claimed in the manifest.

Each issue found by the tool comes with a brief explanation of why it matters and what action to take. The app provides a readiness summary at the end, detailing any problems found. To use the tool, simply drop a ZIP file onto the ExtensionRelease Guard window. It can also export a report in HTML, JSON, or TXT format. Users can compare saved JSON reports to see if new issues have arisen or if previous ones have been resolved.

It's important to note that ExtensionRelease Guard is not a guarantee of a successful upload to the Chrome Web Store. It is a pre-release inspection aid, only reading the archive without extracting or running the code. Therefore, a clean result does not mean the extension is safe or will pass review. The tool only catches the specific issues it is programmed to look for.

ExtensionRelease Guard is free, open source (MIT license), and available for Windows. The executable is unsigned, so SmartScreen may display a warning; however, the SHA-256 hash is provided in the release notes for users to verify the download. The tool can be downloaded from the GitHub repository (https://github.com/InexperiencedPotato/ExtensionReleaseGuard) or directly from the releases page (https://github.com/InexperiencedPotato/ExtensionReleaseGuard/releases).

The developer of ExtensionRelease Guard is open to feedback regarding false positives and any additional checks users would like to see implemented. Issues and pull requests are welcome on the GitHub repository, and there is an optional Ko-fi link for those who find the tool useful.